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We show that the maximum transmission distance of continuous- variable quantum key distribution 
in presence of a Gaussian noisy lossy channel can be arbitrarily increased using a linear noiseless 
amplifier. We explicitly consider a protocol using amplitude and phase modulated coherent states 
with reverse reconciliation. We find that a noiseless amplifier with amplitude gain g can increase 
the maximum admissible losses by a factor g~ 2 . 



I. INTRODUCTION 

Cryptography is certainly one of the most advanced 
applications of quantum technologies. Within this field, 
the most studied primitive is quantum key distribution 
(QKD), which is the art of distributing a secret key to two 
distant parties, Alice and Bob, in an untrusted environ- 
ment controlled by an adversary, Eve pQ . The security of 
QKD lies on the idea that an adversary trying to acquire 
some information about the secret key will necessarily 
introduce some noise in the quantum communication be- 
tween Alice and Bob. A consequence of this idea is that if 
the quantum channel is too lossy or noisy, then it cannot 
be used to distill a secret key. This limits the maximum 
transmission distance between the legitimate parties. De- 
veloping QKD protocols resistant to losses and noise is 
therefore of great practical importance. 

Among QKD protocols, those encoding information in 
the amplitude and phase of coherent states [2] have the 
advantage of only requiring off-the-shelf telecom com- 
ponents, as well as being compatible with wavelength- 
division multiplexing [3], making an interesting solution 
for robust implementations [4] [5] . 

On the theoretical side, these continuous- variable (CV) 
protocols have been proven secure against arbitrary at- 
tacks provided that they are secure against collective at- 
tacks [6 J. This latter condition is in particular met for 
all CV protocols without postselection for which Gaus- 
sian attacks are known to be optimal within collective 
attacks [THE]. 

Protocols with postselection on the other hand [HI [12], 
where Alice and Bob only use part of their data to ex- 
tract a secret key, can increase the robustness of QKD 
to losses and noise but at the price of more involved 
security proofs. In particular, their security is only es- 
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tablished against Gaussian attacks [T3l [14] , or when an 
active symmetrization of the classical data is applied [15] . 

In this paper, we consider the use of a noiseless linear 
amplifier (NLA) [16-2J] on the detection stage as a way 
to increase the robustness of CV QKD protocols against 
losses and noise. First, it should be noted that while am- 
plifiers can effectively recover classical signals, they only 
offer limited advantages when working on quantum sig- 
nals, as amplification is bound to preserve the original 
signal to noise ratio (SNR) [H [22] E3] . This implies that 
ordinary linear amplifiers, as those realized by optical 
parametric processes [24 , can only find limited applica- 
tions in the context of QKD [25] . 

On the other hand, a probabilistic NLA can in principle 
amplify the amplitude of a coherent state while retaining 
the initial level of noise [16] . Thus, when only consid- 
ering its successful runs, the NLA can compensate the 
effect of losses and could therefore be useful for quantum 
communication [26] , and to establish the nonlocal nature 
of quantum correlations thanks to a loophole-free Bell 
test [27] . The availability of such a device has stimulated 
intense experimental activity over the past years, demon- 
strating the implementation of approximated versions 
[T7H2T] . which have provided solid proof-of-principle. 

The question arises if these more sophisticated devices 
can deliver a compensation of losses with a success rate 
such that it may represent a useful tool for quantum cryp- 
tography. Here we address this problem, by investigating 
the advantages and limitations of the most general NLA 
device, without making assumptions on the particular re- 
alization. 

We find a regime in which the NLA leads to an im- 
provement of the maximum transmission distance attain- 
able on a noisy and lossy Gaussian channel. Because of 
the non-deterministic nature of the NLA, the security 
proofs considered here are similar to those concerning 
protocols with postselection, that is, they hold against 
Gaussian attacks, or collective attacks provided an addi- 
tional symmetrization of the classical data is performed. 
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II. DESCRIPTION OF THE GG02 PROTOCOL 

We consider explicitly the case for the most com- 
mon protocol for continuous- variable QKD, designed by 
Grosshans and Grangier (GG02) [2]. In its prepare-and- 
measure (PM) version, Alice encodes information in the 
quadratures of coherent states which are then sent to Bob 
through the untrusted quantum channel. Alice chooses 
her preparation \ol=xa-\-Wa) from a Gaussian distribu- 
tion for the two quadratures having zero mean and vari- 
ance Va- Bob randomly decides whether to measure the 
x or the p quadrature, using homodyne detection. Alice 
and Bob finally extract a secret key from the correlated 
data by performing classical data manipulation and au- 
thenticated classical communication. This protocol of- 
fers a simple experimental implementation [28-31] and 
is secure against finite-size collective attacks [32] as well 
as arbitrary attacks in the asymptotic limit of arbitrary 
long keys [6]. 

This protocol can be reformulated in an entanglement- 
based version (EB), in terms of entanglement distri- 
bution between Alice and Bob [33]: the two par- 
ties in itially share a two- mode squeezed vacuum state 
|A)=Vl — A 2 Xl^Lo ^ n \ n )\ n ), with A<1. Alice performs 
an heterodyne measurement on her mode, which projects 
the other mode on a coherent state. The outcome of 
Alice's measurement is random, but with a probability 
distribution depending on A. 

Although the EB version does not correspond to the 
actual implementation, it is fully equivalent to the PM 
version from a security point of view, and it provides a 
more powerful description for establishing security proofs 
against collective attacks through the covariance matrix 
7ab of the state shared by Alice and Bob before their re- 
spective measurements. In the case of a Gaussian channel 
with transmittance T, and input equivalent excess noise 
£0: 



V(X)l 

7AB " 1 a/T(V(A) 2 - 



_ V T (V(\) 2 - I)z 

1)Z T(V(\)+B + e)l 



where I=diag(l,l) and Z=diag(l, -1), V(A)-±±A 



l-A 2 
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the variance of the thermal state TrA |A)(A| related to 
the modulation variance by Va=V—1, and B=^?- is the 
input equivalent noise due to losses. 

This matrix contains all the information needed to es- 
tablish the secret key rate for collective attacks [29] : 

AJ(A, T, e, /3)=/3I AB (A, T, e) - X be(A, T, e), (2) 

where Jab = \ log2 ( \%bXI ) * s ^ e mutual information 
shared by Alice and Bob given by Shannon's theory [34] . 
and xbe is the Holevo bound for the mutual information 
shared by Eve and Bob (see Appendix [B]) . The reconcil- 
iation efficiency (3<1 accounts for the fact that in prac- 
tical implementations of this protocol, Alice and Bob do 
not have sufficient resources to reach the Shannon limit. 
Steady progress has been made in recent years on the 



problem of error correction for CV QKD [35-37 and to- 
day procedures based on modern error correcting tech- 
niques achieve j3 ~ 95% for a large range of SNR [38] . 



III. EQUIVALENT CHANNEL AND 
SQUEEZING 

Let us now consider the use of a NLA in the GG02 
protocol. As usual, we will perform the security analysis 
of the EB version. Here, we restrict ourselves to the case 
of a Gaussian quantum channel, that is Eve is limited to 
performing Gaussian attacks. Since the secure key rate 
of the protocol depends only on the covariance matrix 
of Alice and Bob 7ab, it is sufficient to compute it in 
presence of the NLA. 

In this modified version of the protocol, Alice and Bob 
implement GG02 as usual but Bob adds a NLA to his 
detection stage, before his homodyne detection, which 
is here assumed to be perfect. Then, only the events 
corresponding to a successful amplification will be used 
to extract a secret key. This scheme is therefore very 
similar to protocols with postselection. 

Since the output of the NLA remains in the Gaus- 
sian regime, we can look for equivalent parameters of an 
EPR state sent through a Gaussian noisy channel. Their 
derivation is explained in detail in Appendix [A] where 
it is shown that the covariance matrix 7ab(A,T, e,g) of 
the amplified state is equal to the covariance matrix 
Jab((,V: e ° i #=1) °f an equivalent system with an EPR 
parameter £, sent through a channel of transmittance rj 
and excess noise e 9 , without using the NLA. Those effec- 
tive parameters are given by: 




l)(e-2)T-2 



DeT 



- 2 

g 2 T 



e^e-Ug'-l) (e - 2) eT. 



(3) 



This identification easily provides the secret informa- 
tion AI 9 corresponding to the successful amplification, 
since Eq. [2] can be used with the effective parameters: 



AJ S (A, T, e, /?) = AJ(£, r], e 9 , , 



(4) 



Those parameters can be interpreted as physical pa- 
rameters of an equivalent system if they satisfy the physi- 
cal meaning constraints 0<C<1, 0<?7<1, and e 9 >0. Since 
A is a global factor in the expression of the first con- 
dition is always satisfied if A is below a limit value: 



0<C<1^0<A< 



V-l)(e-2)T-2 
(# 2 -l)eT-2 



. (5) 



As r] and e 9 do not depend on A, the parameter £ can 
be considered as independent of those two parameters, 
keeping in mind that this simply sets the value of A. 
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Figure 1. Equivalent channel and squeezing: a state |A) sent 
through a Gaussian channel of transmittance T and excess 
noise e, followed by a successful amplification, has the same 
Alice-Bob covariance matrix than a state \Q sent through 
a Gaussian channel of transmittance r/ and excess noise e 9 , 
without the NLA. 



The second and the third conditions are satisfied if the 
excess noise is smaller than 2, and if the gain is smaller 
than a maximum value given by Eq. |A19[ and plotted 
on Fig. |2) 




4 6 
Losses (dB) 

Figure 2. g m &x(T,e) against the losses in dB. e=0.2. 



IV. INCREASE OF THE MAXIMUM 
TRANSMISSION DISTANCE 

The analysis of the equivalent state allows us to com- 
pare the secret key rate obtained with and without an 
ideal NLA. The comparison must be performed for a 
given channel with fixed losses T and excess noise e, as 
those parameters cannot be controlled by Alice or Bob. 
However, since the relevant quantity is the maximum se- 
cret key rate achievable over this channel, Alice is allowed 
to optimize her modulation variance Va (or equivalently, 
the parameter A) in order to maximize the secret key 
rate. 

The secret key rate without the NLA is given by 
A/(A, T, e, P) (Eq. [2|. The secret key rate with the NLA 
A/nla is obtained by multiplying the secret key rate for 
successful amplifications AI g by the probability of suc- 
cess P suc . If the NLA has a sufficient dynamics to neglect 
distortions, we can assume that P suc is constant. This is 



a reasonable assumption if /3<1, since in that case the 
optimal value of Va is not infinite. The precise value of 
P suc will depend on practical implementations, and is not 
important is our study, since it only acts as a scaling fac- 
tor and does not change the fact that a negative secret 
key rate can become positive with a NLA. Therefore, 



AI NLA = PsucAI(C,77,eS). 



(6) 



In Appendix [DJ we show that the probability of suc- 
cess for a NLA of gain g is upper bounded by 1/g 2 . We 
can therefore use this bound, keeping in mind that the 
relevant conclusion which can be taken is only whether 
the secret key rate is positive or not. Both secret key 
rate with and without the NLA are computed using the 
formulae given in Appendix [Bj 

Since the expression of AI is relatively difficult to ma- 
nipulate, we perform a series expansion at the first order 
in T, which corresponds to the strong losses regime (Ap- 
pen dix |C| ). The approximate secret key rate is given by 
Eq. |C1| Its expression gives us an intuition about two 
important behaviors: first, since T appears inside the 
expansion and not only as a global factor, it explains 
why there can be a maximum transmission distance, or 
equivalently a value T\[ m for which the secret key rate 
becomes null. Second, in this regime, the effect of the 
NLA is simply to replace the transmittance T by g 2 T, 
the other physical parameters being the same. Hence, it 
is clear that the losses are reduced, which will increase 
the maximum distance of transmission. 

Let us prove those statements more precisely. From 
Eq. Cl 1 we find an analytical value of Ty im when g=l 



(i.e without the NLA), 



1 



lim 



2A e ( A2 " 1 ) 



«(A2-1) 



(7) 



This expression clearly tends to when e tends to 0, 
which shows that there is no maximum transmission dis- 
tance without excess noise. Interestingly, there is a max- 
imum transmission distance as soon as the excess noise e 
is non zero, even if the reconciliation efficiency j3 equals 
1. When (3 decreases or when e increases, this maximum 
transmission distance decreases. There is no limitation 
of the distance of transmission only when e=0, and in 
that case Eq. |C1| takes a simple form: 



NLA- 



1 „ 2rm2 (l -A 2 ) (/?-21ogA)+21ogA 
(A2-l) 2 log(2) 



-g 2 TX- 



.A/. (8) 



This shows that for strong losses without excess noise, the 
secret key rate using the NLA with the most optimistic 
probability of success is the same as the secret key rate 
without the NLA, and is always positive if A is optimized. 
Ti im can also be optimized (i.e. minimized) by optimizing 
A. Interestingly, the optimal value A op t depends only on 



/?, as shown by Eq. C2 



The same calculation with a NLA of gain g shows that: 

1 „ 



^lim- 



(9) 
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Figure 3. Maximized secret key rate against losses in dB. The 
maximization is performed on A for the series expansion, and 
on £ for the the numerical expression. The numerical curves 
are in excellent agreement with the analytical expansions. As 
explained in the main text, the secret key rate with the NLA 
is very optimistic due to the probability of success 1/g 2 , and 
hence its curve gives only information on its positivity. The 
other parameters are e=0.05, /3=0.95 [38] . 



Figure 4. Maximal excess noise for which the secret key rate 
is positive, against losses. The curves do not depend on the 
probability of success chosen for the NLA. The maximization 
is performed on A for the series expansion, and on £ for the nu- 
merical expression. For low losses, we see that the first order 
expansion is not enough, whereas it is in excellent agreement 
with the numerical curve for strong losses. The reconciliation 
efficiency is £=0.95 [38]. 



Therefore, the losses for which the secret key rate is zero 
are increased by: 

A£ = 201og 10 # dB. (10) 

Let us stress that this result does not depend on the 
probability of success of the NLA, which simply acts as 
a scaling factor for the secret key rate. Hence, even for a 
more realistic probability of success, the NLA increases 
the maximum distance of transmission in the same way. 

Those results are compared with numerical results for 
the full expressions of AI and A/nla, on Fig. [3] and [4] 
For both figures, the secret key rate is computed without 
the NLA and with a NLA of gain g=4 (which is in the 
allowed region of Fig. [2). 

Those figures clearly show that the secret key rate stays 
positive for losses increased by A£=12 dB. Fig. [4] also 
shows that for given losses, the secret key rate stays pos- 
itive for a higher value of excess noise. However, the gain 
in excess noise depends on the losses, and does not have 
a simple analytical expression. 

Another important remark concerns the optimal gain. 
If the transmission can be intuitively increased by in- 
creasing the gain, this is not always the case for the se- 
cret key rate, as shown on Fig. [5] The first reason is the 
competition between the decreasing probability of suc- 
cess 1/g 2 and the potential increase of the secret key rate 
for the successfully amplified states. The second reason is 
due to the dependance on the gain of the effective param- 
eters (Eq. [3]): the higher the gain, the higher 77, but also 
the higher e 9 . If the gain is too high, it is thus possible 
that the effective excess noise e g would be too important, 
for the transmittance 77, to give a positive A/nla- 




Gain g 



Figure 5. Maximized secret key rate against the gain of 
the NLA, with a probability of success 1/g 2 . /?=1, e=0.1, 
losses=30 dB. With a gain g=l, the secret key rate is neg- 
ative. The NLA can increase the secret key rate to positive 
values when the gain is increased up to a certain value, how- 
ever if the gain is too important the secret key rate decreases 
and becomes negative again. The reason is that the effective 
excess noise becomes too important for the effective transmit- 
tance. 



V. DISCUSSION AND CONCLUSION 

In presence of excess noise, the secret key rate of the 
GG02 protocol against Gaussian collective attacks always 
becomes negative for a certain distance of transmission. 
We have shown that the noiseless linear amplifier can 
increase this distance by the equivalent of 20 log 10 g dB 
of losses. We have also shown that for given losses, the 
protocol is more robust against excess noise. 
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Our calculation of the secret key rate with the amplifier 
was based on an effective system for which the security 
proofs are well established. This approach could also find 
applications in other quantum communication protocols 
involving an EPR state sent through a quantum channel, 
followed by a noiseless amplifier. In particular, it could be 
applied to other CV QKD protocols, for instance proto- 
cols using squeezed states or with a heterodyne detection 

EMU] 

A further work would be to consider the experimentally 
demonstrated schemes of the NLA, which are only valid 



approximations of the ideal NLA up to a certain number 
of photons. If the state can be well approximated by 
this truncation, so that the Gaussian approximation still 
holds, the results presented in this paper are still valid. 
On the other hand, if the Gaussian approximation does 
not hold anymore, security proofs are more complicated 
to manipulate. This problem lies beyond the scope of the 
present work, and deserves further investigation. 
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Appendix A: Derivation of the effective parameters 



In this appendix, we detail the method used 



to obtain the effective parameters of Section III 



Let us start by first computing the output of 
the NLA when the input state p is a thermal 
state Ah( A ch) = (l-A^ h )E^o A chl n )( n l displaced by 



(Al) 



This would be the state received by Bob if he knew the 
result of Alice's heterodyne measurement. The state p 
can be decomposed on an ensemble of coherent states 
using the P function: 



P(a)\a)(a\da. 



(A2) 



where P(a) = ^- J (-u\p\u)e u * a - ua * du. Straight- 
forward calculations show that (— ix— /3|p th (A c h)| u—f3) = 

^_ A 2 h ) e -|n| 2 (l+A2 h )-|/3| 2 (l-A2 h ) + (n^*-n*/3)(l-A c 2 h ) 5 and 

therefore P(a x +ia y )=p(a x )p(a y ) , with 




L («x-/3x) 2 



(A3) 



In the absence of thermal noise (A c h=0), the expres- 
sion (A3) becomes proportional to a Dirac distribution 



S(a x — /5x). The same statements hold for p(a y ). 

The successful amplification can ideally be described 
by an operator C=g n , where n is the number operator 
in the Fock basis. The final state has to be normalized, 
but one has to be careful that the norm is not the success 
probability of the transformation, since C is unbounded. 
The amplification of a coherent state \a) leads to an am- 
plified coherent state proportional to \ga): 



C\a)- 



Ml 



(3 2 "1) 



\ga). 



(A4) 



Since C is linear, the amplification of p is simple to de- 
rive, using (A3) and (A4) in the decomposition (A2): 



p = CpC 

P(a)e\ a ^'-%a){ga\6a. 



(A5) 
(A6) 

By introducing the change of variable u=ga, one gets 

p = J P{u/g)e^ W ^\u){u\du. (A7) 



p(u^/g) exp (^-^u^j, the results being 



similar for u y : 



p(u x /g)e 




-(^f-/3x) 2 + 



The argument of the exponential can 
form: 



1-A c 2 h 



A ch 



9 



-1 



2 \2 
ch 



u 2 = 



S 2 \ 2 h 



(A8) 

easily put in the 



!( l- 5 2 )( l_ A 2 h) 



Thermal state gA c h 



2\2 
~ A ch 

Effective gain 



W 2 \ 2 h 



Normalization term 



(A9) 



Thus, the expression (|A9|) clearly corresponds to a ther- 



1 — A 

mal state p th (^A c h) displaced by g 1 _ g2 ^2 fi, up to a 
global unimportant normalization factor independent of 
the variable integrated a or u. We can conclude that: 



p' oc D(g/3)p th (g\ ch )D(-gp). 



(A10) 



1 — A 

where g = g 2 { h 2 . In order to keep a physical inter- 

pretation, we note that g must be such that #A c h<l. 

Let us now find the values of f3 and A c h correspond- 
ing to the Entanglement-Based protocol presented in the 
main text. When Alice obtains the results a a for her 
heterodyne measurement on one mode of the EPR state 
| A), the second mode is projected on a coherent state 
with an amplitude proportional to Xa A [33] . This state 
is then sent through the quantum channel of transmit- 
tance T, with transforms its amplitude to oc y/TXa A . 
The displacement f3 can thus be taken as: 



P = Vf\a A . 



(All) 



The variance 



1-A 2 



of the thermal state corresponds to 



Bob's variance 1+Te when Va=0: 
1 



^ch 



1 



Te 



\ 2 - 
A ch - 



Te 



2 + Te 



(A12) 



Finally, the action of the NLA (Eq. |A1Q ) on a displaced 
thermal state given by Eq. |A11| and |A12| induces the 
transformations: 



Vf\a A -> g- 

NLA * 1 



1-A 



^VTAa A , 



x ch 



Te 



Te 



(A13) 



2 + Te nla * 2 + Te 



The next step is to consider the action of the NLA when 
Bob does not have any knowledge on Alice's measurement 



7 



outcome. In such a case, his state is a thermal state 
p B =(l— A* 2 ) ^^l (A*) 2n |n)(n|, whose variance is given 
by 7ab: 



1+A* 2 +9 T (A 2 (2-e) +e 



l-\* 2 



2- A 2 (2+T(e-2))+Te' 
(A14) 



Since the NLA always transforms a thermal state of pa- 
rameter A* into another thermal state of parameter gA*, 



Eq. A14 shows that the NLA performs the transforma- 
tion: 



T(A 2 (2-6) +e) 



— )> 



T (A 2 (2-6) + e ) 



2-A 2 (2+T (e-2)) +Te nla 3 2- A 2 (2+T (e-2)) +Te ' 

(A15) 



This system can be solved, leading to: 



C = A, 



I tf-T) (e-2)T-2 
( 5 2 -l)eT-2 ' 

9 2 T 



' ( 5 2_l )T (l (5 2_ 1)(e _ 2)eT _ e + 1 ) +1 ' 

69 = e-i( 5 2 -l) (6-2)eT. 

(A17) 

Finally, the expression of the maximum gain g mdiX (T, e) 
for which those parameters take physical values is given 
by: 



5ma X (T, e) 



(A18) 



\ 



e (T (e-4) +2) +4v/ T(e ~ 2)+2 (T (e-2) +2)+4T-4 



T(e-2) 2 



(A19) 



We have now all the required equations to find the 
expression of the effective parameters £, rj and e 9 . Using 
Eq. A13 and A15 those parameters must satisfy: 



] " A ' h VfX, 



ch 



r] (C 2 (2-e*) +e^) 



=9 



Te 



2+Te' 
2 T (A 2 (2-e) +e) 



2-C 2 (2 + r/(e^-2))+^ * 2-A 2 (2+T (e-2)) +Te' 

(A16) 



Let us stress some important comments about those ef- 
fective parameters, which confirm the validity of their 
expression. First, they naturally reduce to the real phys- 
ical parameters without the NLA, for g=l: 



5 = 1 



(A20) 



C = A 
x] — T 

e9 = e 

Then, when there is no excess noise (e=0), they match 
previous results [IB] : 



e = 



C = A y/1 + ~ 1)T 

9 2 T 



Tj 



l+(g*-l)T 

= 



(A21) 



Appendix B: Expressions used to compute the Holevo bound xbe 

The Holevo bound xbe is given by [29 : xbe = G [^] + G [^] - G [^] - G [u*=±] where 

G[x] = (x + l) log 2 [x + l]-x log 2 [x] si x ^0, et G[0] = (Bl) 

M 2 >2 = \ (A ± VA* - 4E) £ A = \{ C± VC 2 -4D) (B2) 

A = V 2 (l-2T) + 2T + T 2 (V + X iin e ) 2 E = T 2 (V X une + 1) 2 (B3) 
VVE + T(V + Xhne ) VEV 

T(V + X line) T(V + X line) K ' 

(B5) 

V=Va+1 is the variance of Alice's thermal state (see text for details), and xiine = + e is the total equivalent 
input noise. Bob's homodyne detection is assumed to be perfect. 



Appendix C: First order expansion in T 

The first order expansion in T of the secret key rate given in Appendix [B] using the NLA is: 
A/nla— 



c g 



,(-2/3A 2 (-l+A 2 ) - e(-l+A 2 ) 2 (l+log[2])+(-l+A 2 )(e(-l+A 2 )(log[e]+log[^T])+4AMog[A])+2A 2 log[A 2 ]) 



(2(-l+A 2 ) 2 log[2] 



(CI) 



The equation that must satisfy the optimal value A opt to maximize the transmission distance (Eq. and maximize 
the secret key rate (Eq. |C1|), is given by : 



Agpt (Ag pt -41og(A pt)-l) _ 

1 \2 — P' 

1 _ A opt 



(C2) 



Fig. [6] shows A opt as a function of j3\ 

I.Of 



0.9 



J* 0.8 



0.7 




0.6l 



Figure 6. A op t against /3. /3—0.95 gives A op t— 0.806. 



Appendix D: Success probability 

The success probability of the NLA can depend on 
many experimental factors. Here, we are interested in 
deriving an upper bound based on very general princi- 
ples, when the success probability can be considered as 
being a constant value. In this way, we can obtain an 
optimistic estimate of its performance, but certainly we 
will not overlook interesting regimes. In both EB and PM 
versions of the GG02 protocol, Bob's state prior to any 
classical communication with Alice is the thermal state 
p B (A*)=(l-A* 2 )Er=o(A*) 2n |n)(n|. 

Consider now that the NLA produces an amplified 
state p B (#A*) with a success probability P suc . When the 
amplification fails, the protocol is aborted, and the state 
is simply replaced by the vacuum |0)(0|. Without post- 
selection, the NLA can therefore be represented as a trace 
preserving operation T described by: 

T(/S B (A*)) = P SU c/3 B (sA*) + (1 - Psuc)|0)<0|. (Dl) 



Naturally, T applied on the vacuum also gives the vac- 
uum, regardless of the value of P suc - Since any trace pre- 
serving quantum operation cannot decrease the fidelity 
T between two quantum states [43], T must verify: 



(p B (A*), |0)(0|) < J-(T(p B GA*), |0)(0|). (D2) 



which gives us an upper bound on P suc . Indeed, i nsert ing 
the expression for Bob's transformed state (Eq. |D1| ) in 
the constraints on fidelities (Eq. |D2[ ), we find that P suc 
must verify: 

<0|p B (A*)|0) < (0|(P SUC/ 9 B ( 5 A*)+(1-P SUC )|0)(0|)|0). 

(D3) 



which is satisfied if: 



D < 

sue _ o • 

g 2 



(D4) 



